diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5e4f41d..aa6d165 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -175,7 +175,7 @@ jobs:
           echo "OK — no sensitive files tracked"
 
       - name: Scan git history for secrets (TruffleHog)
-        uses: trufflesecurity/trufflehog@v3.95.9
+        uses: trufflesecurity/trufflehog@v3.96.0
         with:
           path: ./
           base: ${{ github.event.before || 'HEAD~1' }}